Incomplete URL substring sanitization

[antonym]

Potential fix for https://github.com/netbootxyz/webapp/security/code-scanning/1

To fix the problem, we need to parse the URL and check the host value explicitly. This involves using the url module to parse the URL and then comparing the host against a whitelist of allowed hosts. This approach ensures that the check is not bypassed by embedding the allowed host in an unexpected location.

1. Import the url module at the beginning of the file.
2. Parse the URL to extract the host value.
3. Compare the host value against a whitelist of allowed hosts.

Suggested fixes powered by Copilot Autofix. Review carefully before merging.